CVE-2026-64193

Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR. Net::DNS::RR::OPT::EXTENDED_ERROR::_decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option (RFC 8914) by tokenising the raw bytes and passing the result to Perl's eval. There is some escaping done for $ and @, but not for backticks. This can be exploited for command execution if $pkt->edns->option('EXTENDED-ERROR') is called in array context, for example with a payload of {0:`"<command>"`} in EXTRA-TEXT.

Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR. Net::DNS::RR::OPT::EXTENDED_ERROR::_decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option (RFC 8914) by tokenising the raw bytes and passing the result to Perl's eval. There is some escaping done for $ and @, but not for backticks. This can be exploited for command execution if $pkt->edns->option('EXTENDED-ERROR') is called in array context, for example with a payload of {0:`"<command>"`} in EXTRA-TEXT.

Las versiones de Net::DNS hasta la 1.55 para Perl permiten la inyección de ejecución remota a través de EDNS EXTENDED ERROR. Net::DNS::RR::OPT::EXTENDED_ERROR::_decompose analiza el campo EXTRA-TEXT de una opción EDNS EXTENDED-ERROR (RFC 8914) tokenizando los bytes sin procesar y pasando el resultado a la función eval de Perl. Se realiza cierto escape para $ y @, pero no para las comillas invertidas. Esto puede explotarse para la ejecución de comandos si se llama a $pkt -> edns -> option(’EXTENDED-ERROR’) en un contexto de array, por ejemplo, con una carga útil de {0:““[command]””} en EXTRA-TEXT.